我怎样才能使用大使的-ingress为TLS？

Question

我有个非常快速的问题。为了澄清一些事情，我必须和你分享我的邮递员的结果。

​

​

我要用两篇文章来证明这一点：

https://www.getambassador.io/docs/emissary/pre-release/topics/install/

https://www.getambassador.io/docs/emissary/pre-release/howtos/tls-termination/

我正试图为我的安妞大使添加TLS。一切看起来都很好。请看下面

​

​

但是当我通过https发送请求时(请看上面的邮递员)，它会返回错误：“错误:在建立安全的TLS连接之前断开连接的客户端网络套接字”。

我的deployment.yaml将有助于解决我的问题：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: echo-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: echo-server
  template:
    metadata:
      labels:
        app: echo-server
    spec:
      containers:
        - name: echo-server
          image: jmalloc/echo-server
          ports:
            - name: http-port
              containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: echo-service
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app: echo-server
    
---
apiVersion: x.getambassador.io/v3alpha1
kind: AmbassadorMapping
metadata:
  name: echo-backend
  namespace: default
spec:
  hostname: "*"
  prefix: /echo/
  service: echo-service

---
apiVersion: x.getambassador.io/v3alpha1
kind: AmbassadorListener
metadata:
  name: emissary-ingress-listener-8080
  namespace: emissary
spec:
  port: 8080
  protocol: HTTPPROXY
  securityModel: XFP
  hostBinding:
    namespace:
      from: ALL

---
apiVersion: x.getambassador.io/v3alpha1
kind: AmbassadorHost
metadata:
  name: wildcard-host
spec:
  hostname: "*"
  acmeProvider:
    authority: none
  tlsSecret:
    name: tls-cert
  selector:
    matchLabels:
      hostname: wildcard-host


also I am using curl to be sure
```C

卷曲-Lk https://143.198.247.222/echo/

{

"server": "trim-kumquat-fccjxh8x",

"quote": "Abstraction is ever present.",

"time": "2019-07-24T16:36:56.7983516Z"

}

Answer 1

使者和边缘堆栈实际上处理TLS是一样的-鉴于curl工作，我倾向于认为，您在这里看到的是，您正在按照指示获得一个自签名的TLS证书，邮递员只是对证书比curl更严格。

如果您将-k从curl中删除，我希望它也会失败。同样，如果您在浏览器中执行HTTPS，大多数浏览器对正确的证书都非常挑剔。因此，我建议您从获得一个正确签名的证书开始(也许从“让我们加密？”)开始，然后试试。